You should ask for the old password on every change.